summaryrefslogtreecommitdiffstats
path: root/releasenotes/notes
diff options
context:
space:
mode:
authorOliver Walsh <owalsh@redhat.com>2017-04-19 14:39:42 +0100
committerEmilien Macchi <emilien@redhat.com>2017-05-03 20:20:01 +0000
commitf8ca94a5b7c7658631f5b0a9b010251ebbcff65e (patch)
tree78a29b35d20ad0268634048e525c8f609faf32c3 /releasenotes/notes
parent55d2c44a3b79b7b47972d6166e643d91a3af4465 (diff)
Restrict nova migration ssh tunnel
This change enhances the security of the migration ssh tunnel: - The ssh authorized_keys file is only writeable by root. - Creates a new user for migration instead of using root/nova. - Disables SSH forwarding for this user. - Optionally restricts the networks that this user can connect from. - Uses an ssh wrapper command to whitelist the commands that this user can run over ssh. Requires the openstack-nova-migration package from https://review.rdoproject.org/r/6327 bp tripleo-cold-migration Change-Id: Idb56acd1e1ecb5a5fd4d942969be428cc9cbe293
Diffstat (limited to 'releasenotes/notes')
-rw-r--r--releasenotes/notes/cold_migration_security-1543136408c76459.yaml10
1 files changed, 10 insertions, 0 deletions
diff --git a/releasenotes/notes/cold_migration_security-1543136408c76459.yaml b/releasenotes/notes/cold_migration_security-1543136408c76459.yaml
new file mode 100644
index 0000000..aaea57e
--- /dev/null
+++ b/releasenotes/notes/cold_migration_security-1543136408c76459.yaml
@@ -0,0 +1,10 @@
+---
+features:
+ - |
+ Restrict nova migration ssh tunnel
+ * The ssh authorized_keys file is only writeable by root.
+ * Creates a new user for migration instead of using root/nova.
+ * Disables SSH forwarding for this user.
+ * Restricts the networks that this user can connect from.
+ * Uses an ssh wrapper command to whitelist the commands that this user can run over ssh.
+ Adds new parameter "tripleo::profile::base::nova::migration_ssh_localaddrs" to specify which incoming IPs are allow for SSH tunnel connections.